@stacksjs/sanitizer 0.2.198 → 0.2.200

package/dist/index.js

@@ -1,466 +1,2 @@
 // @bun
-// src/presets.ts
-var strict = {
-  allowedTags: [
-    "p",
-    "br",
-    "strong",
-    "em",
-    "u",
-    "span",
-    "h1",
-    "h2",
-    "h3",
-    "h4",
-    "h5",
-    "h6",
-    "ul",
-    "ol",
-    "li",
-    "code",
-    "pre"
-  ],
-  allowedAttributes: {
-    "*": ["class", "id"]
-  },
-  allowedSchemes: ["http", "https", "mailto"],
-  allowDataAttributes: false,
-  allowAriaAttributes: true,
-  stripTags: true,
-  allowComments: false
-};
-var basic = {
-  allowedTags: [
-    "p",
-    "br",
-    "strong",
-    "em",
-    "u",
-    "span",
-    "div",
-    "h1",
-    "h2",
-    "h3",
-    "h4",
-    "h5",
-    "h6",
-    "ul",
-    "ol",
-    "li",
-    "a",
-    "img",
-    "code",
-    "pre",
-    "blockquote",
-    "table",
-    "thead",
-    "tbody",
-    "tr",
-    "th",
-    "td"
-  ],
-  allowedAttributes: {
-    "*": ["class", "id"],
-    a: ["class", "id", "href", "title", "target", "rel"],
-    img: ["class", "id", "src", "alt", "title", "width", "height"],
-    td: ["class", "id", "colspan", "rowspan", "align"],
-    th: ["class", "id", "colspan", "rowspan", "align", "scope"]
-  },
-  allowedSchemes: ["http", "https", "mailto", "tel"],
-  allowDataAttributes: false,
-  allowAriaAttributes: true,
-  stripTags: true,
-  allowComments: false
-};
-var relaxed = {
-  allowedTags: [
-    "p",
-    "br",
-    "strong",
-    "em",
-    "u",
-    "span",
-    "div",
-    "section",
-    "article",
-    "aside",
-    "h1",
-    "h2",
-    "h3",
-    "h4",
-    "h5",
-    "h6",
-    "ul",
-    "ol",
-    "li",
-    "dl",
-    "dt",
-    "dd",
-    "a",
-    "img",
-    "figure",
-    "figcaption",
-    "code",
-    "pre",
-    "kbd",
-    "samp",
-    "var",
-    "blockquote",
-    "q",
-    "cite",
-    "table",
-    "thead",
-    "tbody",
-    "tfoot",
-    "tr",
-    "th",
-    "td",
-    "caption",
-    "del",
-    "ins",
-    "sub",
-    "sup",
-    "abbr",
-    "address",
-    "time",
-    "hr",
-    "video",
-    "audio",
-    "source",
-    "track"
-  ],
-  allowedAttributes: {
-    "*": ["class", "id", "title"],
-    a: ["class", "id", "href", "title", "target", "rel"],
-    img: ["class", "id", "src", "srcset", "alt", "title", "width", "height", "loading"],
-    video: ["class", "id", "src", "width", "height", "controls", "preload", "poster"],
-    audio: ["class", "id", "src", "controls", "preload"],
-    source: ["src", "type"],
-    track: ["src", "kind", "srclang", "label"],
-    td: ["class", "id", "colspan", "rowspan", "align"],
-    th: ["class", "id", "colspan", "rowspan", "align", "scope"],
-    time: ["class", "id", "datetime"],
-    abbr: ["class", "id", "title"]
-  },
-  allowedSchemes: ["http", "https", "mailto", "tel", "data"],
-  allowDataAttributes: true,
-  allowAriaAttributes: true,
-  stripTags: true,
-  allowComments: false
-};
-var markdown = {
-  allowedTags: [
-    "p",
-    "br",
-    "strong",
-    "em",
-    "span",
-    "h1",
-    "h2",
-    "h3",
-    "h4",
-    "h5",
-    "h6",
-    "ul",
-    "ol",
-    "li",
-    "a",
-    "img",
-    "code",
-    "pre",
-    "blockquote",
-    "table",
-    "thead",
-    "tbody",
-    "tr",
-    "th",
-    "td",
-    "del",
-    "ins",
-    "hr",
-    "input"
-  ],
-  allowedAttributes: {
-    "*": ["class", "id"],
-    a: ["class", "id", "href", "title"],
-    img: ["class", "id", "src", "alt", "title"],
-    code: ["class"],
-    td: ["align"],
-    th: ["align", "scope"],
-    input: ["type", "checked", "disabled"]
-  },
-  allowedSchemes: ["http", "https", "mailto"],
-  allowDataAttributes: false,
-  allowAriaAttributes: false,
-  stripTags: true,
-  allowComments: false
-};
-function getPreset(name) {
-  switch (name) {
-    case "strict":
-      return strict;
-    case "basic":
-      return basic;
-    case "relaxed":
-      return relaxed;
-    case "markdown":
-      return markdown;
-    default:
-      return basic;
-  }
-}
-
-// src/sanitizer.ts
-var DEFAULT_OPTIONS = {
-  allowedTags: [],
-  allowedAttributes: {},
-  allowedSchemes: ["http", "https", "mailto"],
-  allowDataAttributes: false,
-  allowAriaAttributes: true,
-  stripTags: true,
-  allowComments: false
-};
-var DANGEROUS_TAGS = [
-  "script",
-  "iframe",
-  "object",
-  "embed",
-  "applet",
-  "base",
-  "link",
-  "meta",
-  "style"
-];
-var URL_ATTRIBUTES = [
-  "href",
-  "src",
-  "action",
-  "formaction",
-  "data",
-  "poster",
-  "cite",
-  "background",
-  "longdesc"
-];
-var EVENT_ATTRIBUTES_REGEX = /^on\w+/i;
-function sanitize(html, options) {
-  const result = sanitizeWithInfo(html, options);
-  return result.html;
-}
-function sanitizeWithInfo(html, options) {
-  const opts = typeof options === "string" ? getPreset(options) : { ...DEFAULT_OPTIONS, ...options };
-  const removedTags = [];
-  const removedAttributes = [];
-  let result = html;
-  let modified = false;
-  if (!opts.allowComments) {
-    const commentRegex = /<!--[\s\S]*?-->/g;
-    if (commentRegex.test(result)) {
-      result = result.replace(commentRegex, "");
-      modified = true;
-    }
-  }
-  const tagRegex = /<(\/?)([a-zA-Z][\w-]*)([^>]*)>/g;
-  result = result.replace(tagRegex, (match, closing, tagName, attributesStr) => {
-    const lowerTag = tagName.toLowerCase();
-    if (DANGEROUS_TAGS.includes(lowerTag)) {
-      if (!removedTags.includes(lowerTag)) {
-        removedTags.push(lowerTag);
-      }
-      modified = true;
-      return opts.stripTags ? "" : escapeHtml(match);
-    }
-    const allowedTags = opts.allowedTags || [];
-    if (allowedTags.length > 0 && !allowedTags.includes(lowerTag)) {
-      if (!removedTags.includes(lowerTag)) {
-        removedTags.push(lowerTag);
-      }
-      modified = true;
-      return opts.stripTags ? "" : escapeHtml(match);
-    }
-    if (closing) {
-      return match;
-    }
-    const sanitizedAttrs = sanitizeAttributes(attributesStr, lowerTag, opts, removedAttributes);
-    if (sanitizedAttrs !== attributesStr) {
-      modified = true;
-    }
-    if (opts.transformTag) {
-      const attributes = parseAttributes(sanitizedAttrs);
-      const transformed = opts.transformTag(lowerTag, attributes);
-      if (transformed === null) {
-        if (!removedTags.includes(lowerTag)) {
-          removedTags.push(lowerTag);
-        }
-        modified = true;
-        return "";
-      }
-      if (transformed.tagName !== lowerTag || JSON.stringify(transformed.attributes) !== JSON.stringify(attributes)) {
-        modified = true;
-        return buildTag(transformed.tagName, transformed.attributes);
-      }
-    }
-    return `<${tagName}${sanitizedAttrs}>`;
-  });
-  return {
-    html: result,
-    modified,
-    removedTags: removedTags.length > 0 ? removedTags : undefined,
-    removedAttributes: removedAttributes.length > 0 ? removedAttributes : undefined
-  };
-}
-function sanitizeAttributes(attributesStr, tagName, options, removedAttributes) {
-  if (!attributesStr.trim()) {
-    return attributesStr;
-  }
-  const attributes = parseAttributes(attributesStr);
-  const sanitized = {};
-  for (const [name, value] of Object.entries(attributes)) {
-    const lowerName = name.toLowerCase();
-    if (EVENT_ATTRIBUTES_REGEX.test(lowerName)) {
-      if (!removedAttributes.includes(lowerName)) {
-        removedAttributes.push(lowerName);
-      }
-      continue;
-    }
-    if (!isAttributeAllowed(lowerName, tagName, options)) {
-      if (!removedAttributes.includes(lowerName)) {
-        removedAttributes.push(lowerName);
-      }
-      continue;
-    }
-    if (URL_ATTRIBUTES.includes(lowerName)) {
-      if (!isUrlSafe(value, options)) {
-        if (!removedAttributes.includes(lowerName)) {
-          removedAttributes.push(lowerName);
-        }
-        continue;
-      }
-    }
-    if (lowerName === "style" && options.allowedStyles) {
-      sanitized[name] = sanitizeStyle(value, options.allowedStyles);
-    } else {
-      sanitized[name] = value;
-    }
-  }
-  return buildAttributes(sanitized);
-}
-function isAttributeAllowed(attrName, tagName, options) {
-  const allowedAttrs = options.allowedAttributes;
-  if (!allowedAttrs) {
-    return false;
-  }
-  if (attrName.startsWith("data-")) {
-    return options.allowDataAttributes || false;
-  }
-  if (attrName.startsWith("aria-")) {
-    return options.allowAriaAttributes || false;
-  }
-  if (Array.isArray(allowedAttrs)) {
-    return allowedAttrs.includes(attrName);
-  }
-  if (allowedAttrs[tagName]?.includes(attrName)) {
-    return true;
-  }
-  if (allowedAttrs["*"]?.includes(attrName)) {
-    return true;
-  }
-  return false;
-}
-function isUrlSafe(url, options) {
-  if (options.urlValidator) {
-    return options.urlValidator(url);
-  }
-  const trimmed = url.trim().toLowerCase();
-  const cleaned = trimmed.replace(/[\s\x00-\x1F]/g, "");
-  const dangerousProtocols = ["javascript:", "data:text/html", "vbscript:", "file:"];
-  for (const protocol of dangerousProtocols) {
-    if (cleaned.startsWith(protocol)) {
-      return false;
-    }
-  }
-  if (options.allowedSchemes && options.allowedSchemes.length > 0) {
-    if (!cleaned.includes(":")) {
-      return true;
-    }
-    const hasAllowedScheme = options.allowedSchemes.some((scheme) => {
-      return cleaned.startsWith(`${scheme}:`);
-    });
-    if (!hasAllowedScheme) {
-      return false;
-    }
-  }
-  return true;
-}
-function sanitizeStyle(style, allowedStyles) {
-  const properties = style.split(";").filter((p) => p.trim());
-  const sanitized = [];
-  for (const prop of properties) {
-    const colonIndex = prop.indexOf(":");
-    if (colonIndex === -1)
-      continue;
-    const name = prop.substring(0, colonIndex).trim().toLowerCase();
-    const value = prop.substring(colonIndex + 1).trim();
-    if (allowedStyles.includes(name)) {
-      if (!value.toLowerCase().includes("javascript:") && !value.toLowerCase().includes("expression(")) {
-        sanitized.push(`${name}: ${value}`);
-      }
-    }
-  }
-  return sanitized.join("; ");
-}
-function parseAttributes(attributesStr) {
-  const attributes = {};
-  const attrRegex = /([\w-]+)(?:=(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g;
-  let match;
-  while (match = attrRegex.exec(attributesStr)) {
-    const name = match[1];
-    const value = match[2] || match[3] || match[4] || "";
-    attributes[name] = value;
-  }
-  return attributes;
-}
-function buildAttributes(attributes) {
-  const parts = [];
-  for (const [name, value] of Object.entries(attributes)) {
-    if (value === "") {
-      parts.push(name);
-    } else {
-      const escaped = value.replace(/"/g, "&quot;");
-      parts.push(`${name}="${escaped}"`);
-    }
-  }
-  return parts.length > 0 ? ` ${parts.join(" ")}` : "";
-}
-function buildTag(tagName, attributes) {
-  return `<${tagName}${buildAttributes(attributes)}>`;
-}
-function escapeHtml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function isSafe(html, options) {
-  const result = sanitizeWithInfo(html, options);
-  return !result.modified;
-}
-function stripTags(html) {
-  return html.replace(/<[^>]*>/g, "");
-}
-function escape(text) {
-  return escapeHtml(text);
-}
-
-// src/index.ts
-var src_default = sanitize;
-export {
-  stripTags,
-  strict,
-  sanitizeWithInfo,
-  sanitize,
-  relaxed,
-  markdown,
-  isSafe,
-  getPreset,
-  escape,
-  src_default as default,
-  basic
-};
+var L={allowedTags:["p","br","strong","em","u","span","h1","h2","h3","h4","h5","h6","ul","ol","li","code","pre"],allowedAttributes:{"*":["class","id"]},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},B={allowedTags:["p","br","strong","em","u","span","div","h1","h2","h3","h4","h5","h6","ul","ol","li","a","img","code","pre","blockquote","table","thead","tbody","tr","th","td"],allowedAttributes:{"*":["class","id"],a:["class","id","href","title","target","rel"],img:["class","id","src","alt","title","width","height"],td:["class","id","colspan","rowspan","align"],th:["class","id","colspan","rowspan","align","scope"]},allowedSchemes:["http","https","mailto","tel"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},x={allowedTags:["p","br","strong","em","u","span","div","section","article","aside","h1","h2","h3","h4","h5","h6","ul","ol","li","dl","dt","dd","a","img","figure","figcaption","code","pre","kbd","samp","var","blockquote","q","cite","table","thead","tbody","tfoot","tr","th","td","caption","del","ins","sub","sup","abbr","address","time","hr","video","audio","source","track"],allowedAttributes:{"*":["class","id","title"],a:["class","id","href","title","target","rel"],img:["class","id","src","srcset","alt","title","width","height","loading"],video:["class","id","src","width","height","controls","preload","poster"],audio:["class","id","src","controls","preload"],source:["src","type"],track:["src","kind","srclang","label"],td:["class","id","colspan","rowspan","align"],th:["class","id","colspan","rowspan","align","scope"],time:["class","id","datetime"],abbr:["class","id","title"]},allowedSchemes:["http","https","mailto","tel","data"],allowDataAttributes:!0,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},_={allowedTags:["p","br","strong","em","span","h1","h2","h3","h4","h5","h6","ul","ol","li","a","img","code","pre","blockquote","table","thead","tbody","tr","th","td","del","ins","hr","input"],allowedAttributes:{"*":["class","id"],a:["class","id","href","title"],img:["class","id","src","alt","title"],code:["class"],td:["align"],th:["align","scope"],input:["type","checked","disabled"]},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!1,stripTags:!0,allowComments:!1};function M(q){switch(q){case"strict":return L;case"basic":return B;case"relaxed":return x;case"markdown":return _;default:return B}}var I={allowedTags:[],allowedAttributes:{},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},z=["script","iframe","object","embed","applet","base","link","meta","style"],E=["href","src","action","formaction","data","poster","cite","background","longdesc"],R=/^on\w+/i;function W(q,C){return k(q,C).html}function k(q,C){let D=typeof C==="string"?M(C):{...I,...C},j=[],K=[],J=q,Q=!1;if(!D.allowComments){let P=/<!--[\s\S]*?-->/g;if(P.test(J))J=J.replace(P,""),Q=!0}let Y=/<(\/?)([a-zA-Z][\w-]*)([^>]*)>/g;return J=J.replace(Y,(P,y,O,F)=>{let X=O.toLowerCase();if(z.includes(X)){if(!j.includes(X))j.push(X);return Q=!0,D.stripTags?"":V(P)}let G=D.allowedTags||[];if(G.length>0&&!G.includes(X)){if(!j.includes(X))j.push(X);return Q=!0,D.stripTags?"":V(P)}if(y)return P;let $=S(F,X,D,K);if($!==F)Q=!0;if(D.transformTag){let H=f($),Z=D.transformTag(X,H);if(Z===null){if(!j.includes(X))j.push(X);return Q=!0,""}if(Z.tagName!==X||JSON.stringify(Z.attributes)!==JSON.stringify(H))return Q=!0,v(Z.tagName,Z.attributes)}return`<${O}${$}>`}),{html:J,modified:Q,removedTags:j.length>0?j:void 0,removedAttributes:K.length>0?K:void 0}}function S(q,C,D,j){if(!q.trim())return q;let K=f(q),J={};for(let[Q,Y]of Object.entries(K)){let P=Q.toLowerCase();if(R.test(P)){if(!j.includes(P))j.push(P);continue}if(!h(P,C,D)){if(!j.includes(P))j.push(P);continue}if(E.includes(P)){if(!c(Y,D)){if(!j.includes(P))j.push(P);continue}}if(P==="style"&&D.allowedStyles)J[Q]=w(Y,D.allowedStyles);else J[Q]=Y}return U(J)}function h(q,C,D){let j=D.allowedAttributes;if(!j)return!1;if(q.startsWith("data-"))return D.allowDataAttributes||!1;if(q.startsWith("aria-"))return D.allowAriaAttributes||!1;if(Array.isArray(j))return j.includes(q);if(j[C]?.includes(q))return!0;if(j["*"]?.includes(q))return!0;return!1}function c(q,C){if(C.urlValidator)return C.urlValidator(q);let j=q.trim().toLowerCase().replace(/[\s\x00-\x1F]/g,""),K=["javascript:","data:text/html","vbscript:","file:"];for(let J of K)if(j.startsWith(J))return!1;if(C.allowedSchemes&&C.allowedSchemes.length>0){if(!j.includes(":"))return!0;if(!C.allowedSchemes.some((Q)=>{return j.startsWith(`${Q}:`)}))return!1}return!0}function w(q,C){let D=q.split(";").filter((K)=>K.trim()),j=[];for(let K of D){let J=K.indexOf(":");if(J===-1)continue;let Q=K.substring(0,J).trim().toLowerCase(),Y=K.substring(J+1).trim();if(C.includes(Q)){if(!Y.toLowerCase().includes("javascript:")&&!Y.toLowerCase().includes("expression("))j.push(`${Q}: ${Y}`)}}return j.join("; ")}function f(q){let C={},D=/([\w-]+)(?:=(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g,j;while(j=D.exec(q)){let K=j[1],J=j[2]||j[3]||j[4]||"";C[K]=J}return C}function U(q){let C=[];for(let[D,j]of Object.entries(q))if(j==="")C.push(D);else{let K=j.replace(/"/g,"&quot;");C.push(`${D}="${K}"`)}return C.length>0?` ${C.join(" ")}`:""}function v(q,C){return`<${q}${U(C)}>`}function V(q){return q.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function T(q,C){return!k(q,C).modified}function N(q){return q.replace(/<[^>]*>/g,"")}function A(q){return V(q)}var s=W;export{N as stripTags,L as strict,k as sanitizeWithInfo,W as sanitize,x as relaxed,_ as markdown,T as isSafe,M as getPreset,A as escape,s as default,B as basic};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/sanitizer",
   "type": "module",
-  "version": "0.2.198",
+  "version": "0.2.200",
   "description": "A fast, native Bun-powered HTML sanitizer with DOMPurify-like features. Protection against XSS and malicious content.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",